Define How Security Controls Contribute to Business Operating Cost and Offsetting Risk. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A mid-sized financial services firm is evaluating a new SIEM platform. The annual license and infrastructure cost is $250,000, and the security team estimates it will require 1.5 full-time employees (FTEs) at $120,000 each annually to operate. Based on historical incident data, the firm estimates that without the SIEM, they face a 30% annual probability of a breach costing $1.5 million in direct response, legal fees, and regulatory fines. Which additional factor is MOST critical to determine whether this control investment is financially justified?

   • AThe brand reputation of the SIEM vendor compared to competitors
   • BThe firm's current annual IT budget as a percentage of revenue
   • CThe expected reduction in breach probability attributable to the SIEM
   • DThe number of security alerts the SIEM will generate per day
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An organization purchases cyber insurance to cover losses from a potential data breach. This is an example of which risk offset mechanism?

   • ARisk acceptance
   • BRisk reduction
   • CRisk transfer
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A global manufacturing company is implementing multi-factor authentication (MFA) for all employees. The security team estimates the solution will cost $200,000 annually. However, the operations director reports that the additional authentication step adds approximately 3 minutes per employee per day, and with 5,000 employees, this translates to significant lost productivity. Which approach BEST balances the security benefit with the business operating cost impact?

   • AImplement MFA only for users accessing sensitive systems and privileged accounts
   • BAbandon MFA entirely to avoid any productivity impact
   • CDeploy MFA for all employees and accept the productivity loss as a necessary cost of security
   • DImplement MFA but only during business hours to minimize disruption
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When a security control requires employees to spend time on compliance tasks, this is best described as which type of operating cost impact?

   • AA capital expenditure
   • BA productivity impact
   • CA direct cost of the control
   • DA risk transfer cost
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large e-commerce company is evaluating a new Web Application Firewall (WAF). The WAF costs $100,000/year to deploy and maintain. The company's risk assessment shows a 20% annual probability of a web application breach with an average impact of $800,000. The security team estimates the WAF will reduce the probability of a breach by 50%. However, the WAF is expected to introduce 100ms of latency, which the marketing team estimates will reduce online sales by $30,000/year. What is the NET financial benefit (or loss) of implementing the WAF?

   • ANet loss of $50,000 per year
   • BNet loss of $10,000 per year
   • CNet benefit of $80,000 per year
   • DNet benefit of $30,000 per year
   Reveal Solution Discussion Select an answer first